NPM: fix security update for indirect and direct dependencies

[jakecoffman]

What are you trying to accomplish?

When a security update is run and the project has the vulnerability as both a direct dependency, and indirect dependency of other top-level dependencies, Dependabot only fixes the top-level dependency.

By using the audit's abilities during the lowest_security_fix_version check we can return nil to force a full unlock.

Also made a slight modification to return audit results more often when doing a security update.

Anything you want to highlight for special attention from reviewers?

How will you know you've accomplished your goal?

I have a real-world test here: https://github.com/dsp-testing/npm-multiple-top-level-ancestors

The PR created should remove all instances of the vulnerable lodash.

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[jakecoffman]

Verified it bumps the top-level and the parent of a transient dependency: dsp-testing/npm-multiple-top-level-ancestors#1